New issue
Advanced search Search tips

Issue 915524 link

Starred by 1 user

Issue metadata

Status: Verified
Owner:
Closed: Jan 10
Cc:
Components:
EstimatedDays: ----
NextAction: ----
OS: Linux
Pri: 1
Type: Bug



Sign in to add a comment

Null-dereference READ in av_encryption_info_add_side_data

Project Member Reported by ClusterFuzz, Dec 16

Issue description

Detailed report: https://clusterfuzz.com/testcase?key=6490309141463040

Fuzzer: afl_audio_decoder_fuzzer
Fuzz target binary: audio_decoder_fuzzer
Job Type: afl_chrome_asan
Platform Id: linux

Crash Type: Null-dereference READ
Crash Address: 0x000000000018
Crash State:
  av_encryption_info_add_side_data
  
Sanitizer: address (ASAN)

Regressed: https://clusterfuzz.com/revisions?job=afl_chrome_asan&range=582253:582258

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=6490309141463040

Issue filed automatically.

See https://github.com/google/clusterfuzz-tools for instructions to reproduce this bug locally.
 
Project Member

Comment 1 by ClusterFuzz, Dec 16

Components: Internals>Media>FFmpeg
Labels: Test-Predator-Auto-Components
Automatically applying components based on crash stacktrace and information from OWNERS files.

If this is incorrect, please apply the Test-Predator-Wrong-Components label.
Project Member

Comment 2 by ClusterFuzz, Dec 16

Cc: mmoroz@chromium.org
Labels: ClusterFuzz-Auto-CC
Automatically adding ccs based on OWNERS file / target commit history.

If this is incorrect, please add ClusterFuzz-Wrong label.
Project Member

Comment 3 by ClusterFuzz, Dec 16

Cc: modma...@google.com
Labels: Test-Predator-Auto-CC
Automatically adding ccs based on suspected regression changelists:

libavutil/encryption_info: Add unit tests. by modmaker@google.com - https://chromium.googlesource.com/chromium/third_party/ffmpeg/+/69bd73b3ff873abb43de9db062b04425de153643

libavutil/encryption_info: Allow multiple init info. by modmaker@google.com - https://chromium.googlesource.com/chromium/third_party/ffmpeg/+/b86c5757a2bf2a589b3982d6b85401165deb4958

If this is incorrect, please let us know why and apply the Test-Predator-Wrong-CLs label.
Cc: -mmoroz@chromium.org -modma...@google.com dalecur...@chromium.org
Owner: modma...@google.com
Project Member

Comment 5 by bugdroid1@chromium.org, Dec 27

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/third_party/ffmpeg/+/7954815a61c424c51ffc96101807809a1cd733b6

commit 7954815a61c424c51ffc96101807809a1cd733b6
Author: Jacob Trimble <modmaker@google.com>
Date: Thu Dec 27 19:48:13 2018

libavformat/mov: Fix NULL-dereference read for some encrypted content.

When reading frames, we need to use the fragment for the correct
stream.  Sometimes the "current" fragment is not the same as the one
the frame is for.

Bug: 906392
Bug:  915524 
Change-Id: I5ad5799ea9f966573d00fc8ef746446bfff85a16
Reviewed-on: https://chromium-review.googlesource.com/c/1385044
Reviewed-by: Dale Curtis <dalecurtis@chromium.org>
Reviewed-by: Frank Liberato <liberato@chromium.org>

[modify] https://crrev.com/7954815a61c424c51ffc96101807809a1cd733b6/libavformat/mov.c

Project Member

Comment 6 by ClusterFuzz, Jan 10

ClusterFuzz has detected this issue as fixed in range 621228:621259.

Detailed report: https://clusterfuzz.com/testcase?key=6490309141463040

Fuzzer: afl_audio_decoder_fuzzer
Fuzz target binary: audio_decoder_fuzzer
Job Type: afl_chrome_asan
Platform Id: linux

Crash Type: Null-dereference READ
Crash Address: 0x000000000018
Crash State:
  av_encryption_info_add_side_data
  
Sanitizer: address (ASAN)

Regressed: https://clusterfuzz.com/revisions?job=afl_chrome_asan&range=582253:582258
Fixed: https://clusterfuzz.com/revisions?job=afl_chrome_asan&range=621228:621259

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=6490309141463040

See https://github.com/google/clusterfuzz-tools for instructions to reproduce this bug locally.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.
Project Member

Comment 7 by ClusterFuzz, Jan 10

Labels: ClusterFuzz-Verified
Status: Verified (was: Untriaged)
ClusterFuzz testcase 6490309141463040 is verified as fixed, so closing issue as verified.

If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue.

Sign in to add a comment